From dd339987089b4e4a1848aed9774baaee383f5b09 Mon Sep 17 00:00:00 2001 From: omer-vishlitzky Date: Tue, 11 Aug 2026 13:01:26 +0300 Subject: [PATCH 1/2] feat: add merge queue to osac-test-infra, grant wg-infra bypass on github-config osac-test-infra: - Add merge queue with same settings as osac (REBASE, ALLGREEN, batch 4) - Add required status checks (e2e gates + check-labels) - Add wg-infra as ruleset bypass team - Remove push_allowances (conflicts with merge queue bot) - Depends on: label-gate, e2e gate jobs, and auto-queue workflows being added to osac-test-infra repo first github-config: - Add wg-infra team with admin permission - Add wg-infra as ruleset bypass team (can force merge) Assisted-by: Claude Code Signed-off-by: omer-vishlitzky --- repositories.tf | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/repositories.tf b/repositories.tf index 9f2415d..4d6747d 100644 --- a/repositories.tf +++ b/repositories.tf @@ -38,11 +38,16 @@ module "repo_github_config" { required_status_checks = [ { context = "pre-commit", integration_id = 15368 }, ] + ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] teams = [ { team_id = "fulfillment-wg" permission = "push" + }, + { + team_id = "wg-infra" + permission = "admin" } ] } @@ -307,8 +312,26 @@ module "repo_osac_test_infra" { } ] required_approvals = null - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] - environments = [{ name = "e2e-test" }] + required_status_checks = [ + { context = "e2e-vmaas-gate", integration_id = 15368 }, + { context = "e2e-bmaas-gate", integration_id = 15368 }, + { context = "e2e-caas-gate", integration_id = 15368 }, + { context = "check-labels", integration_id = 15368 }, + ] + ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + # push_allowances removed: classic branch protection's "Restrict who can + # push" blocks the merge queue bot. Ruleset update rule handles this instead. + environments = [{ name = "e2e-test" }] + + merge_queue = { + merge_method = "REBASE" + max_entries_to_build = 4 + max_entries_to_merge = 5 + min_entries_to_merge = 1 + min_entries_to_merge_wait_minutes = 5 + check_response_timeout_minutes = 120 + grouping_strategy = "ALLGREEN" + } } module "repo_massopencloud_templates" { From b78026aa576c89bf08c839d295e6f32c79c18b8f Mon Sep 17 00:00:00 2001 From: omer-vishlitzky Date: Tue, 11 Aug 2026 17:17:20 +0300 Subject: [PATCH 2/2] fix: replace update rule with pull_request rule in ruleset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The update rule blocks ALL ref updates including auto-merge evaluation, causing "Cannot update this protected ref" on every PR. The pull_request rule blocks direct pushes ("Changes must be made through a pull request") without interfering with the merge queue or auto-merge. required_approving_review_count = 0 because native GitHub reviews are not used — approval is handled by Prow labels and the check-labels gate. Assisted-by: Claude Code Signed-off-by: omer-vishlitzky --- modules/common_repository/main.tf | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index 09007dc..a3d200e 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -147,10 +147,16 @@ resource "github_repository_ruleset" "status_checks" { } rules { - # When merge queue is enabled, block direct pushes via the ruleset - # instead of classic branch protection's restrict_pushes — the merge - # queue bot cannot be added to branch protection but can bypass rulesets. - update = var.merge_queue != null ? true : false + # When merge queue is enabled, require a PR for all changes. This + # blocks direct `git push` to main (unlike `update = true` which also + # breaks auto-merge evaluation). Native review count is 0 because + # approval is handled by Prow labels + check-labels gate. + dynamic "pull_request" { + for_each = var.merge_queue != null ? [1] : [] + content { + required_approving_review_count = 0 + } + } required_status_checks { # When merge queue is enabled, strict is unnecessary — the queue tests